Skip to content

Concepts

Workspaces and Projects

How workspaces and projects create clear identity and runtime boundaries in Lamba.

Workspace

Workspace is the product-facing boundary for ownership, billing, custom domains, security posture, team access, plan limits, audit visibility, and console administration.

Team Members operate inside the Workspace. They receive Workspace roles and may also receive Project console roles for selected Projects.

Projects

Projects define runtime access for your product. A Project can expose different auth methods, role catalogs, custom-domain bindings, webhook endpoints, growth workflows, and lifecycle events per environment.

Projects can represent:

  • a SaaS customer portal
  • a mobile app
  • a game title
  • an internal tool
  • a public community
  • a separate product line

Public and private Projects

Public Projects can allow discovery, public join, or register flows. Private Projects normally require direct invitation or operator-managed membership.

Project Members belong to Projects. They receive Project roles for runtime/product access. They do not automatically become Team Members.

Environment separation

Each Project can have environment-specific auth, webhook, domain, and growth settings. Sandbox and production should stay separate in credentials, redirect URIs, webhook endpoints, campaign audiences, and analytics.

Why this model works

  • Workspace owns customer-facing auth and API domains.
  • Project owns runtime membership, roles, and permissions.
  • Team Member and Project Member stay separate so console access never silently becomes runtime access.
NeedBoundary
Billing and plan ownershipWorkspace
Console operator accessTeam Member + Workspace role
Product/runtime accessProject Member + Project role
Customer auth settingsProject environment
Webhooks and lifecycle eventsProject environment
Campaign and loyalty contextProject environment

Troubleshooting

If data appears under the wrong product, check whether the request used the correct Project context. If a user has the wrong access, check whether you are looking at Team Member console roles or Project Member runtime roles.

  • Core Concepts: /docs/concepts/core-concepts
  • Environment Separation: /docs/concepts/environments
  • Member Lifecycle: /docs/concepts/member-lifecycle